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Abstract 

We propose an approach for quantifying a quantum circuit's quantumness as a means to understand the 
nature of quantum algorithmic speedups. Since quantum gates that do not preserve the computational basis 
are necessary for achieving quantum speedups, it appears natural to define the quantumness of a quantum 
circuit using the number of such gates. Intuitively, a reduction in the quantumness requires an increase in 
the amount of classical computation, hence giving a "quantum and classical tradeoff" . 

In this paper we present two results on this direction. The first gives an asymptotic answer to the question: 
"what is the minimum number of non-basis-preserving gates required to generate a good approximation to a 
given state" . This question is the quantum analogy of the following classical question, "how many fair coins 
are needed to generate a given probability distribution" , which was studied and resolved by Knuth and Yao 
in 1976. Our second result shows that any quantum algorithm that solves Grover's Problem of size n using 
k queries and £ levels of non-basis-preserving gates must have k ■ £ — Q(n). 
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1 Introduction. 



The importance of quantum computing lies in the possibihty that quantum mechanical algorithms may 
be dramatically more efficient than the best classical algorithms. In order to understand the nature of 
quantum speedup, it is important to identify features of quantum computing that are uniquely quantum 
and investigate their roles in quantum speedups. One example of this kind of study was taken by Jozsa and 
Linden 8 , which relates the amount of entanglement during the computation to the difhculty of simulating 
the computation. Our work is alone a similar line, but instead of entanglement, we study another feature of 
quantum computing: the number of gates that do not preserve the computational basis. 

It is well known that any classical computation can be carried out, without much sacrifice in the efficiency, 
using classical reversible gates, such as the Toffoli gate. In order to have nontrivial quantum speedup, gates 
that do not preserve the computational basis must be used. Furthermore, the more such gates involved, the 
more difficult a straightforward classical simulation is. 

Recall that the state space of a qubit has an orthonormal basis, denoted by {|0), that is fixed a 
priori and called the computational basis. The computational basis for the state space of n qubits is the 
tensor products of their computational bases. Each qubit of a quantum computer is assumed to start in the 
computational base state |0). We follow this convention throughout this paper. 

Let us formally call a gate G basis- changing if there exist two computational base vectors |0) and 
such that |((/>|G|'0)| < 1- If G is not basis-changing, G is said to be basis-preserving. An important example 
of a basis-changing gate is the Hadamard gate 

i/'^=i'-i=(|0)(0| + |l)(0| + |0)(l|-|l)(l|). 

It is well known (e.g. that any quantum circuit can be efficiently simulated by Toffoli and Hadamard 

gates. It is also easy to observe that a quantum circuit that uses k Hadamard gates, together with some other 
basis-preserving gates, can be simulated straightforwardly by a deterministic algorithm with a 2*^' factor of 
slow-down. 

Hence, it appears natural to quantify the amount of "quantumness" of a quantum circuit by the number 
of basis-changing gates, and to investigate the tradeoffs between this amount of quantumness with the best 
possible quantum speedup. This is precisely the theme of our investigation. 

Many interesting questions can be asked in this diction. In particular, we present two results in this 
paper. The first is on the following question: what is the minimum number of basis-changing gates required 
to generate a good approximation of a given quantum state? This is in analogy to the following classical 
question: what is the least number of fair coins required to produce a given probability distribution? In 1976, 
Knuth and Yao 10" solved this problem completely: the minimum expected number of fair coins needed is 
equal to the Shannon entropy of the distribution plus some universal constant. We find that the answer to 
the quantum problem is similar. 

The second result investigates the quantum-classical tradeoffs in solving Grover's Problem [7], also called 
the Unstructured Search Problem, an important and well studied problem in quantum computing. We 
prove that any quantum algorithm that solves Grovers' Problem of size n using k queries and £ levels of 
basis-changing gates must have k ■ £ = n{n). This tradeoff relation is tight. 

We shall present these two results in the following two sections, followed by a discussion of open problems. 

2 Quantum State Generation. 

A classical problem studied by Knuth and Yao in JUj is the following: how many independent 0/1 variables 
are needed in order to generate a given probability distribution? They prove that the minimum expected 
number of coins is precisely H{T>), the Shannon entropy of I?, plus some universal constant. In this section 
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we study the quantum analog of the question: how many basis-changing gates are needed in order to generate 
a good approximation of a given quantum state? 

For a quantum state denote by the Shannon entropy of the probabiUty distribution obtained 

from measuring |(/)) in the computational basis. We prove both upper and lower bounds to the quantum 
problem in terms of H{(j)). 

2.1 Upper bound. 

We first consider a special case, and then reduce the general case to it. 

Lemma 2.1. Let |(/)) be a state over n qubits with nonnegative amplitudes, and e > be a real constant. 
Then there is a quantum algorithm that uses 0{nlogj) basis- changing gates and maps |0)®" to a state \4>') , 
such that II |(/)') - < e. 

The algorithm is along the lines of the algorithm in for approximating an operator that maps \q) (g) 10)**" 

to l<z)«(E,.o..,-i;^b->)- 

Proof. Suppose 

j/e{o,i}" 

For < t < n, and y € {0, 1}*, let 

E Py^' a^d, |</>*) E V%\y)^\or"''- 

ze{0,l}""' yefo,!}* 

Then {(bo) = |0)®", and |0„) = |0). 

The algorithm has n stages. At the i^^ stage, the algorithm transforms |0i) to a state |0i+i) such that 
II ~ <^'i+i) II ^ s/'^i and uses £ =^ [log j~\ basis-changing gates. This can be done by the following. 

1. For each y G {0, 1}*, let 9y arccos i\/ Qyo / qy) ■ Compute on the ancilla and using Toffoli gates the 
first £ bits of Oy/n, Oy^i, ay,2, • • • , ay^g. This maps \(j)t) ® \0)'^^ to 

E V%\y) |0)®"~* (E) \ay,i,ay,2, ■■■ , (ly^i). 
ae{o,i}' 

2. Denote by R(&) the single qubit rotation operator of an angle B. Let &y ~ lO-y.sT^ l'^^ ■ For 
s = l..£, apply the Controlled-_R(aj, ,j7r/2^) gate with the s"^ qubit in the ancilla as the control qubit 
and the (t -\- 1) qubit in the output state as the destination qubit. This results in mapping 

E V%\y)®\o) ^ E V%\y)^RiW- 

ye{asy ve{o,iy 
Since ||i?(e';) - R{ey)\\ < 7r/2^ and 

|0t+i>- E V9^|y)®m)|o>«5|o) 

the resulted vector satisfies 

|||</';+i)-|0m)ll <'r/2^. 
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Hence, setting i — [log2(7rn/e)] , the algorithm outputs a state |(/)') \4>'n+i) that satisfies 



t=i 

The total number of basis-changing gates used is n • ^ = 0(n log ^). □ 

We now consider the the general case. 

Theorem 2.2. Let \(j)) be a quantum state over n qubits and e > be a constant. Then there exists a 
quantum algorithm that uses 0{^H{(j)) log ^'^f^ ) = 0{H{(f))\ogH{(f))) number of basis- changing gates, and 
maps lO)**" to a state such that 

1110') II (1) 

Proof. Suppose for some > and g [0, 27r), Pi > 0, < i < A'^ — 1, 

Af-l 
1=0 

where Y^^S^ pi = 1. 

We first observe that the basis-preserving gate 

i 

maps 

\4>) ^ X! Vp» I*)> 

i=O..JV-l 

and vice verser. Therefore we can assume that a; = 0, for all i. 
For a real A > 1 to be determined later, define 

W^A = {^:p.>2-^^(^)}, p^^Y.P^^ a^d, 



Then we have p < \. Hence, \Wx\ < 2^"^'^\ and 

m)-\ci^x)\\ <p<\- 

Now set k XH{(f)). After an appropriate permutation a on {0, 1}'', \(f>\) can be written as 

dcf 



IV'a) = ct|(/)a) = ^ V^\x). 

x£{0,l}'= 

By Lemma we can generate a state 1-0^) using 0(fclog(Afc)) basis-changing gates and 

lilV';)-|V'A)||<^. 

The output state is |0^) =^ (T^^\tp'^), which satisfies 

\m - m < \m) - + im - m < m - + va < 2/a. 
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Setting A = 2/e, this gives the required precision. The total number of basis-changing gates used is 

0(fclog(Afc)) = 0{-^H{^)\og^) - O(i/(0)logi/(0)). 



□ 



Remark 2.3 (Improving the upper bound). Since for some quantum states |(/)), a small perturbation may 
reduce H((f)) dramatically, the upper bound in Theorem 12.21 may be improved by approximating such a lower 
entropy approximation state. For example, consider 

m = {i-6)\o)+Y: ^^^5^N>. 

Then H^^ = 8(logiir). On the other hand, if e > 2S, the constant state |0) is an e-approximation of j^^). 
Hence no basis-changing gate is needed at all. 



2.2 Lower bound. 

We can generalize the definition of H{<j)) to H{p) for a mixed state p in the obvious way. Denote the trace 
norm of a matrix M by |jAf||tr- Given a state \(j>) and a real e > let 

77,(0) inf {H{p):\\p~\q^)mtr<e}. 

Note that He{4>) could be substantially smaller than H{(f)), as demonstrated by the example in Remark 12.31 
On the other hand, for some family of states, such as the uniform superpositions {-^^ X)i=o JV-i K) ^ > 0}, 
H,{<j)) = e(iJ(0)), for small e. 

Theorem 2.4. Let \(f>) be a quantum state and e > be a constant. Then any quantum algorithm that 
generates a mixed state p that satisfies \\p— \(t>) {(j)\\\tr < e must use Q{H^{(I))) number of basis- changing gates. 

Notice that if |||0) - |0')|| < e, then 

\m(<l>\-W)(cb'\\\tr<2e. 

Therefore, in general, the algorithm in Theorem l2.2l is almost tight (up to a logarithmic factor) for sufficiently 
small e and family of states that have Hf{(p) — Q{H{(j))). 

Proof of Theorem \2.4\ Suppose k number of basis-changing gates are used to generate p. We will prove 
that k = fl{H^{(j))). 

Denote the state after the i*'' basis-changing gate by < i < k. Note that p = F{\(pk){<t'k\), for 
some physically realizable operator F, which is a composition of a permutation (with some phase) of the 
computational basis followed a partial trace. Hence 

H{^k) > H{p) > HM)- (2) 

Since iJp = 0, it suffices to prove that iJi+i < Hi + C, for all < i < — 1, and some constant C. 

Fix at, 0<t<fc— 1. Let Ut be the t^^ basis-changing gate, which is applied to a set of qubits A. The 
other qubits are denoted by B. Note that the number of qubits in A, denoted by C, is a constant. Denote by 
A' and B' two new systems that have the same number of qubits as in A and B, respectively. Let Copy[A; A'] 
be the product of ControUed-Not gates that use qubits in A as the control and the corresponding qubits in 
A' as the destination. Similarly define Copy[B; B]. Let 

IV-t) iCopy[A;A]-Copy[B;B]) !</)*) as |00 ••• 0)^-b-. 
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Define IV't+i) similarly. Denote the von Neumann entropy of a mixed state by E{-). Then 



Ht = E mt}{i't\)AB) - E mt}{i't\)A'B') . 

The second equality follows from that Itpt) is a pure state. Similarly, 

Ht+i = E ii\ijt+l){A+l\)AB) = E mt+l){i^t+l\)A'B') . 

By the subadditivity of von Neumann entropy, 

i^ldVi+iXV-t+ilU'S') <£^((IV^t+i)(V^t+i|)A') + ^((IV^t+i)(V't+i|s')- 

Since 

\^t) = [Copy[A;A']-Ul -CopylA-^A']) 

we have 

Emt+i){A+i\)B') = Emt){^t\)B'). 

The latter is exactly 

EimmABA' < Eii\i;t){i^t\)AB) + E{{\^t){^t\)A'), 
by the subadditivity again. Putting the above together, we have 

Hk+i < Hk + E{{\i;t){A\)A) + Eii\i^t+i){A+i\)A') < Hk + 2C. 
Together with (|2Jl, this implies k = Q{Ht{(f>j). □ 

3 Quantum and Classical Tradeoffs in solving Grover's Problem. 

In this section, we prove a quantum and classical tradeoff relation for Grover's Problem 7 , which is also 
called Unstructured Search Problem. We start with the framework in which Grover's Problem is formulated 
and then present the main result. 

3.1 Grover's Problem. 

The input to Grover's Problem (or, the Unstructured Search Problem) of size n is a binary string x — 
XqX2 ■ ■ ■ Xn-i, where Xi £ {0, 1}, < i < n — 1, with the promise that there exists one and only one index i 
such that Xi = I. The task is to identify i. The complicacy is that x is known only to an oracle, which can 
only be accessed by applying the oracle gate Ox'- 

Ox\i,b) ^\i,b®x^), 0<i<n-l, 6e{0,l}. 

Hence, in general, an algorithm would start with a constant vector \(f)o) in its state space, apply a sequence 
of unitary transformations Uq, Ox, Ui, Ox, ■ ■ • , Ox, Ut, which is followed by a measurement that would 
output i with a high probability (say > 2/3). The complexity of the algorithm is T, the number of applications 
of Ox- 

In one of the most important papers in quantum computing, Grover 7 discovered a surprising quantum 
algorithm that makes only 0{\/n) queries, a quadratic speedup over the best possible classical algorithm. 
Because Grover's Problem is formulated in such a general way, Grover's Algorithm can be used in solving 
many other problems with a quantum speedup. A recent example is Ambainis' quantum algorithm for the 
classical problem of Element Distinctness In fact, Grover's Problem is an example of problems formulated 
in the so-called "black-box model", which has been widely studied by many authors (see, e.g., the survey of 
Ambainis |2j). 
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3.2 Quantum and classical tradeoffs for Grover's Problem. 

Much work has been done on proving lower bounds in the quantum black-box model (see, e.g., two repre- 
sentative papers by Beals, Buhrman, Cleve, Mosca, and de Wolf |4j, and by Ambainis PP). In fact, the tight 
lower bound for Grover's Problem was known before Grover's work due to Bennett, Bernstein, Brassard, 
and Vazirani and was refined by Boyer, Brassard, H0yer, and Tapp [S], and by Zalka [T^ . 

Theorem 3.1 (H]). Any quantum algorithm for solving Grover's Problem of size n must query VL{^/n) 
times. 

A quantum black-box algorithm can viewed as a sequence of blocks of classical reversible computation 
that may include oracle queries and are separated by layers of basis-changing gates. For example, for some 
T — 8(v^), Grover's Algorithm uses 2T+0{1) Fourier transforms, and in between, T oracle queries together 
with other classical reversible computation. We are interested in the tradeoff of the number of basis-changing 
layers and the number of queries. 

Theorem 3.2. Any quantum algorithm solving Grover's problem of size n using T queries and i Fourier 
transforms must satisfy T ■ £ = fl(n). 

A special case where the algorithm is required to make s queries non-adaptively, for a fixed s, before 
making a local computation was studied by Zalka |12j , which implies the same lower bound as the above for 
this case. 

It is not hard to see that this tradeoff relation is optimal as long as T = il{y/n): 

Proposition 3.3. For any T > 'Jn, there exists a quantum algorithm that solves Grover's Problem of size 
n using Q{T) queries and &(n/T) layers of basis- changing gates. 

3.3 Proofs. 

We shall prove Theorem 13.21 bv a generalized form of the "quantum adversary" technique of Ambainis 
which we now briefly review. 

Let / be a function defined on two disjoint sets X and Y, where X, Y C {0, 1}", and for any pair x X, 
and y€Y, f{x) ^ f{y). Let Re X xY, and 

m min \{y : {x, y) £ , t =^ max \{y : (x, y) G R and Xi ^ yj| , 

xex xeXAe[n] 

and m' and i' are defined similarly with X (x) and Y (y) switched. Then 

Lemma 3.4 ([1 ). Any quantum algorithm that computes f with error probability < e, < e < 1/2, must 
make il{y^ mm' / ££') queries. 

This can be proved by considering the changes on a "progress indicator" after each query of the algorithm. 
Specifically, suppose we fix an algorithm that makes T queries. Let ) be the state with oracle z and after 
the i'^ oracle query. Define the progress indicator 

Pt E,ex..veY [ ]' i = 0,-- - ,T. 

Notice that only the oracle gate may change the progress indicator. Clearly pq — I. Furthermore, since 
the algorithm succeeds with a probability at least 1 — e > 1/2, 

Proposition 3.5 (Ijj). For some constant c, < c < 1, pr < c. 
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The lower bound is then estabhshed by proving 



\pt-pt-i\=0{^IFfnvrnI), Vi G [T]. 

In our context, we shaU consider the change on the progress indicator pt after a sequence of classical 
reversible computation with oracle queries. 

Lemma 3.6. Let f, X, Y, and pt be as described above. Let k S [n], and 

def \{y ■ ix,y) (z R, y differs from x when restricted to s\\ 
ak = max ^ — . 

xex,sCln],\s\=k \{y : (x.y) G R}\ 

Similarly define with x switched with y and X switched with Y. Then for any t, after a sequence of 
classical reversible computation that uses k queries, 



\pt -J3t+fc| = 0(V"fc • Pk)- 

Proof. Denote the computational basis by C. Denote the starting state (before the sequence of classical 
reversible computation) with oracle z by 

For an input z e {0, 1}", denote by the permutation on the computational basis specified by the algorithm. 
Then after the classical reversible computation, |</)z) Uz\(j)z)- Hence the change of the progress indicator 

\pt~Pt+k\ = I E.^^y [{(l)x\(l)y)] - E^^y [{(t>x\(jlcry\(t)y)] \ 

E[\{^May - L\cl,y)\] (3) 
^ M E El7-.'=|-|^^.='|-|(c|4a,-/|c')| (4) 



is upper bounded by 



R 

{x,y)eR c,c' 



< 



Y1 \1x,c\ ■ \ly,c'\ (5) 

(x,j,)eR, c, c' 
C'^C, Cry(c')=(T^(c) 

^ hx,c\ ■ \ly,c\- (6) 



R 

(i,y)en. c 



Let us bound the second summation © first. After applying Cauchy-Schwartz, we have the upper bound 



1 

1^ 



E E 



\ X,C y:(^,y)eR \ V ,C x:(x,y)en 



E E i^^.^i'- (7) 



A fixed combination of x and c determines a set of k coordinates being queried. If y is identical to x in these 
coordinates then ay{c) = ax{c). Therefore, with 

mx — max \{y : {x, y) € R and y differs from x when restricted to s}| , 
and niy similarly defined, the above equation is further upper bounded by 
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since < ak and < Pk- 

Now we bound the first summation Q. By Cauchy-Schwartz, it is upper-bounded by 



1 



E E 



\ c'^c, a^(c)=ay{d) \ c^d , cr^ (c)=(Tj, (c') 



E E i7... 



The constraints on y and c' in the first summation are equivalent to that (Tx{c) 7^ o'j,(c) and c' = (Tjcra;(c), 
therefore the above is upper bounded by EquationEI hence by ^/akPk as well. Therefore, the change on the 
progress indicator is at most 2\/akPk- n 



Remark 3.7. A lower bound better than 2\fakfik is y (X^x "^x) • (X^j, where m^; and vny are defined 
in the above proof. However, for our purpose of proving Theorem 13.21 both bounds are the same. 
We are now ready to prove Theorem 13. 21 

Proof of Theorem \cl.<H For the purpose of proving lower bound, it suffices to consider the following decision 
version of Grover's problem: determine whether or not the oracle is bq = 0" or e^, the n bit binary string 
that has the single 1 at the z-th position, for some i G [n]. Let / in Lemma 13.61 be this decision problem and 
set 

X =^ {eq}, y { e, : 1 < z < n }, and, R 1^'' X x Y. 

Fix an algorithm that makes T queries and £ levels of basis-changing gates. Then the algorithm can be 
divided into £+1 blocks of classical reversible computation with the £ basis-changing layers separating them. 
Number the blocks by 1,2, •• • For each block s, let kg be the number of queries in this block, and 

Ps-i be the progress indicator at the beginning of the block. The progress indicator at the end of the last 
block is denoted by pe+i- We have Yll=i ^T, po — 1, and pe+i < c for some constant c with < c < 1. 

Furthermore, for each ks, 

k. 



Then, by Lemma l3.6l 
Hence 



ak, = — , and, Pk, = 1- 
n 



\Ps-Ps-i\^0{^/kJ^), Vse[^ + l]. 



J2 \fkj^=m)- 
By the Cauchy-Swartz Inequality, the left hand side is upper-bounded by 



/(^ + l)-( ^-)/" ^^W^-T/n). 



y s=i..t+i 

YLence £-T ^n{n). □ 

Proposition l3.3l can be proved by using a mixture of classical exhaustive algorithm and Grover's algorithm. 

Proof of Provosition \y.!A Consider the following algorithm. Divide the n bits binary string into /i \(n/t)'^~\ 
blocks. Apply Grover's algorithm to search for a block that contains the 1, and within each block, query all 
the bits. The total number of queries is Q{^/h ■ ^) = 0(T), and the total number of layers of basis-changing 
gates is e{Vh) = e{n/T). □ 
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4 Discussion. 



We initiate the study of what we called "quantum and classical tradeoffs" , which in essence is the relation of 
the number of basis-changing gates in a quantum circuit with the computation power of the quantum circuit. 
Specifically, we prove lower and upper bounds on the number of basis-changing gates for generating a given 
quantum state, and prove an optimal tradeoff relation between the number of a layers of basis-changing 
gates and the number of queries for algorithms that solve Grover's Problem. We shall conclude this paper 
by formulating a class of open problems in this direction. 

Since Toffoli and Hadamard are universal for quantum computing (see, e.g., Shi we can assume that 
any quantum circuit involves only these two gates. Notice that the composition of a set of Hadamard gates 
is just a Fourier transform over a tensor product of Z2. 

For each integer fc > 0, define the complexity class FHk {FH meant to stand for "Fourier Hierarchy) 
to be languages that can be decided with a bounded error probability by a quantum circuit of polynomial 
size and < k Fourier transforms. Notice that if only uniform families of quantum circuits are considered, 
FiJo — P, and FHi = BPP. When k — 2, FH2 starts to have nontrivial quantum computation power. 
For example, the oracle version of FH2 includes Simon's problem, and Factoring can be done in FH2 via 
Kitaev's Phase Estimation Algorithm. 

It appears a reasonable conjecture that in general, the number of Fourier transforms can not be reduced 
without substantial increase of the circuit size. 

Conjecture 4.1. For any k>0, FHk £ FFlk+i- 

Since we do not know how to prove strong lower bounds in a general model, one may have to consider first 
oracle versions of the problem, that is, show an exponential separation between FHk and FHk+i relative to 
an oracle for any fc. Simon's Problem provides an oracle separation for FHi and FH2. The iterated version 
of it, as well as the Recursive Fourier Sampling problem in ^ appear to be good candidates for an oracle 
separation for a general k. 

5 Acknowledgment 

I would like to thank Mike Mosca for pointing out that Factoring can be done with two Fourier transforms 
via Kitaev's Phase Estimation Algorithm, and the related work of Zalka. I am also indebted to Scrap Savari 
for a useful discussion regarding Shannon entropy. 



References 

[1] Andris Ambainis. Quantum lower bounds by quantum arguments. In Proceedings of the Thirty-second 
Annual ACM Symposium on the Theory of Computing, pages 636-643, Portland, Oregon, May 2000. 

[2] Andris Ambainis. Quantum query algorithms and lower bounds. In Proceedings of Foundations of the 
Formal Sciences HI, September 2001. 

[3] Andris Ambainis. Quantum walk algorithm for element distinctness. Pre-print: quant-ph /OS 11 OOH 
2003. 

[4] Robert Beals, Harry Buhrman, Richard Cleve, Michele Mosca, and Ronald de Wolf. Quantum lower 
bounds by polynomials. Journal of the ACM, 48(4):778-797, July 2001. 

[5] Charles H. Bennett, Ethan Bernstein, Gilles Brassard, and Umesh Vazirani. Strengths and weaknesses 
of quantum computing. SIAM Journal on Computing, 26(5):1510-1523, October 1997. 



10 



[6] Michel Boyer, Gilles Brassard, Peter Hyer, and Alain Tapp. Tight bounds on quantum searching. 
Technical Report PP-1996-11, Department of Mathematics and Computer Science, Odense University, 
May 30 1996. Mon, 7 Oct 1996 11:36:47 GMT. 

[7] Lov K. Grover. A fast quantum mechanical algorithm for database search. In Proceedings of the 
Twenty- Eighth Annual ACM Symposium on the Theory of Computing, pages 212-219, Philadelphia, 
Pennsylvania, May 1996. 

[8] Richard Jozsa and Noah Linden. On the role of entanglement in quantum computational speed-up. 
Pre-print: |quant-ph70201143| 2002. 

[9] A. Yu. Kitaev, A. H. Shen, and M. N. Vyalyi. Classical and quantum computation, volume 47 of 
Graduate Studies in Mathematics. American Mathematical Society, Providence, RI, 2002. Translated 
from the 1999 Russian original by Lester J. Senechal. 

[10] Knuth and Yao. The complexity of nonuniform random number generation. In J. F. Traub, editor. 
Algorithms and Complexity: New Directions and Recent Results, pages 357-428. Academic Press, 1976. 

[11] Yaoyun Shi. Both Toffoli and Hadamard need little help to do universal quantum computation. Quantum 
Information and Computation, 3(l):84-92, 2003. 

[12] Christof Zalka. Grover's quantum searching algorithm is optimal. Physical Revew A, 60:2746-2751, 
October 1999. 



11 



